google container_cluster master_auth should be optional

builtin/providers/google/resource_container_cluster.go

@@ -25,8 +25,9 @@ func resourceContainerCluster() *schema.Resource {
 		Schema: map[string]*schema.Schema{
 			"master_auth": &schema.Schema{
 				Type:     schema.TypeList,
-				Required: true,
+				Optional: true,
 				ForceNew: true,
+				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"client_certificate": &schema.Schema{
@@ -342,19 +343,18 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 	zoneName := d.Get("zone").(string)
 	clusterName := d.Get("name").(string)
 
-	masterAuths := d.Get("master_auth").([]interface{})
-	if len(masterAuths) > 1 {
-		return fmt.Errorf("Cannot specify more than one master_auth.")
+	cluster := &container.Cluster{
+		Name:             clusterName,
+		InitialNodeCount: int64(d.Get("initial_node_count").(int)),
 	}
-	masterAuth := masterAuths[0].(map[string]interface{})
 
-	cluster := &container.Cluster{
-		MasterAuth: &container.MasterAuth{
+	if v, ok := d.GetOk("master_auth"); ok {
+		masterAuths := v.([]interface{})
+		masterAuth := masterAuths[0].(map[string]interface{})
+		cluster.MasterAuth = &container.MasterAuth{
 			Password: masterAuth["password"].(string),
 			Username: masterAuth["username"].(string),
-		},
-		Name:             clusterName,
-		InitialNodeCount: int64(d.Get("initial_node_count").(int)),
+		}
 	}
 
 	if v, ok := d.GetOk("node_version"); ok {

builtin/providers/google/resource_container_cluster_test.go

@@ -28,6 +28,23 @@ func TestAccContainerCluster_basic(t *testing.T) {
 	})
 }
 
+func TestAccContainerCluster_withMasterAuth(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckContainerClusterDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccContainerCluster_withMasterAuth,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContainerCluster(
+						"google_container_cluster.with_master_auth"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccContainerCluster_withAdditionalZones(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
@@ -375,6 +392,13 @@ resource "google_container_cluster" "primary" {
 	name = "cluster-test-%s"
 	zone = "us-central1-a"
 	initial_node_count = 3
+}`, acctest.RandString(10))
+
+var testAccContainerCluster_withMasterAuth = fmt.Sprintf(`
+resource "google_container_cluster" "with_master_auth" {
+	name = "cluster-test-%s"
+	zone = "us-central1-a"
+	initial_node_count = 3
 
 	master_auth {
 		username = "mr.yoda"

website/source/docs/providers/google/r/container_cluster.html.markdown

@@ -49,16 +49,16 @@ resource "google_container_cluster" "primary" {
 * `initial_node_count` - (Required) The number of nodes to create in this
     cluster (not including the Kubernetes master).
 
-* `master_auth` - (Required) The authentication information for accessing the
-    Kubernetes master.
-
 * `name` - (Required) The name of the cluster, unique within the project and
     zone.
 
 * `zone` - (Required) The zone that the master and the number of nodes specified
     in `initial_node_count` should be created in.
 
 - - -
+* `master_auth` - (Optional) The authentication information for accessing the
+    Kubernetes master.
+
 * `additional_zones` - (Optional) If additional zones are configured, the number
     of nodes specified in `initial_node_count` is created in all specified zones.